Setup to reverse engineer the Browser Remote API of the Canon C100 II

Last year I invested in my first cinema camera, a used Canon C100 II. Although it doesn’t come with all the flashy features of a more recent camera like the Canon C70 (e. g. 4k resolution, 10-bit colour depth, …), in my book, it is undeniably a 1080P workhorse in a near-perfect package.

When I looked through the C100 II’s manual, I learned that it comes with built-in WiFi and offers a Browser Remote interface. However, since the web interface is not mobile-friendly and looks a bit dated, I was curious how hard it would be to reverse engineer the underlying API.

This article describes how to set up the Browser Remote function and analyze the traffic between the browser and the camera.

The C100 II supports connecting to an existing WiFi network (Infrastructure mode) or can provide an access point itself (Camera Access Point mode). Sadly, the Browser Remote functionality is only available in Access Point mode, which means the device controlling the camera doesn’t have internet access.

Before enabling the Browser Remote functionality, create and select a new network configuration but make sure to pick Camera Access Point as the wireless connection mode. Other than that, the setup steps should be self-explanatory, like choosing an SSID or encryption mode and password.

However, if you are unsure about one of the setup steps, the official C100 II manual may help you out (WiFi functionality starts on page 145).

Now that the network settings are set up, we only need to turn on the Browser Remote function. Once activated, the camera provides an access point using the selected network configuration.

After connecting to the camera’s access point, open the following address within your browser http://192.168.0.80.

A few redirects later, you should see the Browser Remote interface and can start controlling your camera.

With the Browser Remote interface running in a browser, it is just a matter of analyzing the requests and responses. I used the network tab within Google Chrome DevTools and Wireshark for that purpose. The Chrome DevTools are sufficient for most parts, but redirects make tracing the initial API calls harder. Therefore, I used Wireshark to investigate the initialization.

Luckily, the Browser Remote API utilizes the HTTP protocol, and responses use the JSON format, making it relatively easy to digest.